ID: Sample Name: French.exe Cookbook: default.jbs Time: 15:57:57 Date: 24/03/2018 Version:

Transcription

1 ID: Sample Name: French.exe Cookbook: default.jbs Time: 15:57:57 Date: 24/03/201 Version:

2 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Signature Overview AV Detection: Data Obfuscation: System Summary: Anti Debugging: Malware Analysis System Evasion: Hooking and other Techniques for Hiding and Protection: Language, Device and Operating System Detection: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Unpacked PE Files Domains Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshots Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info General File Icon Static PE Info General Entrypoint Preview Data Directories Sections Resources Imports Possible Origin Network Behavior Code Manipulations Copyright Joe Security LLC 201 Page 2 of 16

3 Statistics Behavior System Behavior Analysis Process: French.exe PID: 340 Parent PID: 3000 General File Activities File Created File Deleted File Written Analysis Process: cmd.exe PID: 3436 Parent PID: 340 General File Activities File Read Disassembly Code Analysis Copyright Joe Security LLC 201 Page 3 of 16

4 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: Start time: 15:57:57 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Sample file name: Cookbook file name: 0h 2m 46s false light French.exe default.jbs Analysis system description: Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java ) Number of analysed new started processes analysed: 4 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Analysis stop reason: Detection: Classification: HCA Information: HCA enabled EGA enabled HDC enabled Timeout MAL mal4.winexe@4/1@0/0 EGA Information: Successful, ratio: 100% HDC Information: Successful, ratio: 39.% (good quality ratio 24.5%) Quality average: 46.5% Quality standard deviation: 42.6% Cookbook Comments: Failed Adjust boot time Correcting counters for adjusted boot time Adjusted system time to: 1//200 Found application associated with file extension:.exe Stop behavior analysis, all processes terminated Warnings: Show All Exclude process from analysis (whitelisted): conhost.exe, dllhost.exe Report size getting too big, too many NtQueryValueKey calls found. Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Copyright Joe Security LLC 201 Page 4 of 16

5 Strategy Score Range Further Analysis Required? Threshold false Confidence Classification Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Signature Overview Copyright Joe Security LLC 201 Page 5 of 16

6 AV Detection Data Obfuscation System Summary Anti Debugging Malware Analysis System Evasion Hooking and other Techniques for Hiding and Protection Language, Device and Operating System Detection Click to jump to signature section AV Detection: Multi AV Scanner detection for submitted file Data Obfuscation: Contains functionality to dynamically determine API calls Sample is packed with UPX System Summary: Detected potential crypto function PE file contains strange resources Classification label Contains functionality to instantiate COM classes Contains functionality to load and extract PE file embedded resources Creates temporary files Executes batch files Found command line output Reads software policies Sample is known by Antivirus (Virustotal or Metascan) Spawns processes Uses an in-process (OLE) Automation server Anti Debugging: Contains functionality to dynamically determine API calls Contains functionality which may be used to detect a debugger (GetProcessHeap) Creates guard pages, often used to prevent reverse engineering and debugging Malware Analysis System Evasion: Found evasive API chain (may stop execution after checking a module file name) Program exit points Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) Language, Device and Operating System Detection: Copyright Joe Security LLC 201 Page 6 of 16

7 Contains functionality to query windows version Behavior Graph Hide Legend Behavior Graph ID: Sample: French.exe Startdate: 24/03/201 Architecture: WINDOWS Score: 4 Legend: Process Signature Created File DNS/IP Info Is Dropped Is Windows Process Number of created Registry Values Number of created Files Multi AV Scanner detection for submitted file started Visual Basic Delphi Java.Net C# or VB.NET C, C++ or other language Is malicious French.exe 2 started cmd.exe Simulations Behavior and APIs Time Type Description 15:59:01 API Interceptor 2x Sleep call for process: cmd.exe modified Antivirus Detection Initial Sample Source Detection Scanner Label Link French.exe 40% virustotal Browse Dropped Files No Antivirus matches Unpacked PE Files No Antivirus matches Copyright Joe Security LLC 201 Page 7 of 16

8 Domains No Antivirus matches Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context Dropped Files No context Screenshots Copyright Joe Security LLC 201 Page of 16

9 Startup System is w7 French.exe (PID: 340 cmdline: 'C:\Users\user\Desktop\French.exe' MD5: 06903D30BF26ECB44361BA65A1FC75) cmd.exe (PID: 3436 cmdline: C:\Windows\system32\cmd.exe /c ''C:\Users\HERBBL~1\AppData\Local\Temp\French.bat'' MD5: AD7B9C1403B52BC532FBA594342B9) cleanup Created / dropped Files C:\Users\HERBBL~1\AppData\Local\Temp\French.bat Process: File Type: Size (bytes): 429 C:\Users\user\Desktop\French.exe ASCII text, with CRLF line terminators Entropy (bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: false 3B24677EEB2DC76D14A211A603B31 6BC49EDA5ABDC43727A10217F910AFFFF61B69B B13A79B04EF33CFA B0E0C0A F1ADBAFFD45 E724F09539BA6D7BD1BE2A91F9E02FDCB03D901AED4F7C40B62AAB2B4956F14BC3C22FCB6DECE166C F1F4635EC56E2C0E2D92A10BADB7923D9 false low Copyright Joe Security LLC 201 Page 9 of 16

10 Contacted Domains/Contacted IPs Contacted Domains No contacted domains info Contacted IPs No contacted IP infos Static File Info General File type: Entropy (bit): PE32 executable (console) Intel 036, for MS Wind ows, UPX compressed TrID: Win32 Executable (generic) a ( /4) 99.39% UPX compressed Win32 Executable (30571/9) 0.30% Win32 EXE Yoda's Crypter (26571/9) 0.26% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% File name: File size: MD5: SHA1: SHA256: SHA512: File Content Preview: French.exe 06903d30bf26ecb44361ba65a1fc75 2b3f605de729a3ee30655b15aa6c7005b49a5 0a73d51457c1e15d3f575f3e4023b9b7fb0e6a27b4c7 44a4a77c9f4b2d479 47ad6fb91d47f23da0737fe90cce3a5ee61ca7efb94df5c 10cdaaffda271504e2fcc362bfbeb2d54a5d69e92e15 2a0c147a29a1635d07503c31bd290e3 MZ...@...!..L.!Th is program cannot be run in DOS mode...$...-..\i...i...i...?...{...i...m...i...* n...o...j...h...o...h...h...richi......pe..l...h...p. File Icon Static PE Info General Entrypoint: Entrypoint Section: Digitally signed: Imagebase: Subsystem: Image File Characteristics: DLL Characteristics: Time Stamp: TLS Callbacks: CLR (.Net) Version: OS Version Major: 4 OS Version Minor: 0 File Version Major: 4 File Version Minor: 0 Subsystem Version Major: 4 Subsystem Version Minor: 0 Import Hash: 0x41d4f0 UPX1 false 0x windows cui LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED 0x491AC0 [Thu Jul 31 11:57: UTC] d60f4435b5ef34227b42ded647f66f54 Copyright Joe Security LLC 201 Page 10 of 16

11 Entrypoint Preview Instruction pushad mov esi, h lea edi, dword ptr [esi h] push edi or ebp, FFFFFFFFh jmp 00007FA9B0EE2232h nop nop nop nop nop nop mov al, byte ptr [esi] inc esi mov byte ptr [edi], al inc edi add ebx, ebx jne 00007FA9B0EE2229h mov ebx, dword ptr [esi] sub esi, FFFFFFFCh adc ebx, ebx jc 00007FA9B0EE220Fh mov eax, h add ebx, ebx jne 00007FA9B0EE2229h mov ebx, dword ptr [esi] sub esi, FFFFFFFCh adc ebx, ebx adc eax, eax add ebx, ebx jnc 00007FA9B0EE2211h jne 00007FA9B0EE222Bh mov ebx, dword ptr [esi] sub esi, FFFFFFFCh adc ebx, ebx jnc 00007FA9B0EE2206h xor ecx, ecx sub eax, 03h jc 00007FA9B0EE222Fh shl eax, 0h mov al, byte ptr [esi] inc esi xor eax, FFFFFFFFh je 00007FA9B0EE2296h mov ebp, eax add ebx, ebx jne 00007FA9B0EE2229h mov ebx, dword ptr [esi] sub esi, FFFFFFFCh adc ebx, ebx adc ecx, ecx add ebx, ebx jne 00007FA9B0EE2229h mov ebx, dword ptr [esi] sub esi, FFFFFFFCh adc ebx, ebx adc ecx, ecx jne 00007FA9B0EE2242h inc ecx add ebx, ebx jne 00007FA9B0EE2229h mov ebx, dword ptr [esi] Copyright Joe Security LLC 201 Page 11 of 16

12 Instruction sub esi, FFFFFFFCh adc ebx, ebx adc ecx, ecx add ebx, ebx jnc 00007FA9B0EE2211h jne 00007FA9B0EE222Bh mov ebx, dword ptr [esi] sub esi, FFFFFFFCh adc ebx, ebx jnc 00007FA9B0EE2206h add ecx, 02h cmp ebp, FFFFF300h adc ecx, 01h lea edx, dword ptr [edi+ebp] cmp ebp, FFFFFFFCh jbe 00007FA9B0EE2231h mov al, byte ptr [edx] inc edx mov byte ptr [edi], al inc edi dec ecx jne 00007FA9B0EE2219h jmp 00007FA9B0EE21h nop mov eax, dword ptr [edx] Data Directories Name Virtual Address Virtual Size Is in Section IMAGE_DIRECTORY_ENTRY_EXPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_IMPORT 0x260a4 0x114.rsrc IMAGE_DIRECTORY_ENTRY_RESOURCE 0x1e000 0x0a4.rsrc IMAGE_DIRECTORY_ENTRY_EXCEPTION 0x0 0x0 IMAGE_DIRECTORY_ENTRY_SECURITY 0x0 0x0 IMAGE_DIRECTORY_ENTRY_BASERELOC 0x0 0x0 IMAGE_DIRECTORY_ENTRY_DEBUG 0x0 0x0 IMAGE_DIRECTORY_ENTRY_COPYRIGHT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_GLOBALPTR 0x0 0x0 IMAGE_DIRECTORY_ENTRY_TLS 0x0 0x0 IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 0x0 0x0 IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_IAT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 0x0 0x0 IMAGE_DIRECTORY_ENTRY_RESERVED 0x0 0x0 Sections Name Virtual Address Virtual Size Raw Size Xored PE ZLIB Complexity File Type Entropy Characteristics UPX0 0x1000 0x1000 0x0 False 0 empty 0.0 IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_UNINITIALIZED_ DATA, IMAGE_SCN_MEM_READ UPX1 0x x5000 0x400 False data IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DA TA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ.rsrc 0x1e000 0x9000 0x200 False data IMAGE_SCN_CNT_INITIALIZED_DA TA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ Resources Name RVA Size Type Language Country RT_ICON 0x1e374 0x422 dbase IV DBT of \200.DBF, blocks size 64, block length 1696, next free block index 40 RT_ICON 0x225a0 0x25a data RT_ICON 0x24b4c 0x10a data Copyright Joe Security LLC 201 Page 12 of 16

13 Name RVA Size Type Language Country RT_ICON 0x25bf 0x46 GLS_BINARY_LSB_FIRST RT_DIALOG 0x1b050 0x12a data RT_STRING 0x1b17c 0x10 data RT_STRING 0x1b1c 0xc data RT_STRING 0x1b19 0x6e data RT_STRING 0x1b20 0x36 data RT_GROUP_ICON 0x x3e MS Windows icon resource - 4 icons, 64x, 256-colors None 0x1b20 0x9 data English United States None 0x1b2c 0x10 data None 0x1b29c 0x1b4 data None 0x1b450 0x10 data None 0x1b460 0x1 very short file (no magic) Imports DLL KERNEL32.DLL ole32.dll OLEAUT32.dll USER32.dll Import LoadLibraryA, GetProcAddress, VirtualProtect, ExitProcess CoGetObject VarBstrFromCy CopyRect Possible Origin Language of compilation system Country where language is spoken Map English United States Network Behavior No network behavior found Code Manipulations Statistics Behavior French.exe cmd.exe Click to jump to process Copyright Joe Security LLC 201 Page 13 of 16

14 System Behavior Analysis Process: French.exe PID: 340 Parent PID: 3000 General Start time: 15:5:5 Start date: 01/0/200 Path: Wow64 process (32bit): Commandline: Imagebase: File size: MD5 hash: Has administrator privileges: Programmed in: Reputation: C:\Users\user\Desktop\French.exe false 'C:\Users\user\Desktop\French.exe' 0x bytes 06903D30BF26ECB44361BA65A1FC75 true C, C++ or other language low File Activities File Created File Path Access Attributes Options Completion Count C:\Users\HERBBL~1\AppData\Local\Temp\French.bat C:\Users\HERBBL~1\AppData\Local\Temp\French.bat read attributes normal and synchronize and generic write read attributes normal and synchronize and generic write synchronous io non alert and n on directory file synchronous io non alert and n on directory file Source Address Symbol success or wait 1 40BBD CreateFileA success or wait 1 40C6EE CreateFileA File Deleted File Path Completion Count Source Address Symbol C:\Users\HERBBL~1\AppData\Local\Temp\French.bat success or wait 1 40BC0D DeleteFileA C:\Users\HERBBL~1\AppData\Local\Temp\French.bat success or wait 1 40CE47 DeleteFileA File Written File Path Offset Length Value Ascii Completion Count Source Address Symbol Copyright Joe Security LLC 201 Page 14 of 16

15 File Path Offset Length Value Ascii Completion Count Source Address Symbol C:\Users\HERBBL~1\AppData\Local\Temp\French.bat unknown 429 0d 0a d 20 2d 2d 2d 2d 2d @rem Exescript Options Begin @rem scr<wbr>ipttype: success or wait 1 40CDC WriteFile f f 6e console..@rem e 20 2d 2d 2d 2d 2d 0d 0a d a f 6e 73 6f 6c 65 0d 0a d f a d 70 0d 0a d f 6e 3a DestDirectory: temp..@rem Icon: O:\ To ols \ SimpleX_\ ST_to ols\fenrir_codex\tool s\setupsc r<wbr>ipt\codex_srcfiles\ Icon.ico..@rem OutputFile: O:\_Test _1_\French.exe..@rem f 3a 5c 5f 5f 5f 5f 5f 5f 54 6f 6f 6c 73 5f 5f 5f 5f 5f 5f 5f 5c 5f 5f 5f d 70 6c f 5c 5f 5f f 74 6f 6f 6c 73 5c e f 43 4f c 54 6f 6f 6c 73 5c c 43 4f f c c f 6e 2e f 0d 0a d 20 4f c 65 3a 20 4f 3a 5c 5f f 31 5f 5c e e d 0a d 20 2d File Path Offset Length Completion Count Source Address Symbol Analysis Process: cmd.exe PID: 3436 Parent PID: 340 General Start time: 15:5:5 Start date: 01/0/200 Path: Wow64 process (32bit): Commandline: Imagebase: File size: MD5 hash: Has administrator privileges: Programmed in: Reputation: C:\Windows\System32\cmd.exe false C:\Windows\system32\cmd.exe /c ''C:\Users\HERBBL~1\AppData\Local\Temp\French.bat'' 0x4a bytes AD7B9C1403B52BC532FBA594342B9 true C, C++ or other language high File Activities File Read File Path Offset Length Completion Count Source Address C:\Users\HERBBL~1\AppData\Local\Temp\French.bat unknown 191 success or wait 12 4A54DE3 ReadFile C:\Users\HERBBL~1\AppData\Local\Temp\French.bat unknown 191 end of file 1 4A54DE3 ReadFile C:\Users\HERBBL~1\AppData\Local\Temp\French.bat unknown 191 end of file 1 4A54DE3 ReadFile C:\Users\HERBBL~1\AppData\Local\Temp\French.bat unknown 191 end of file 1 4A54DE3 ReadFile Symbol Disassembly Copyright Joe Security LLC 201 Page 15 of 16

16 Code Analysis Copyright Joe Security LLC 201 Page 16 of 16